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Abstract 



A simple binary model to compute the degree of balancedness in the 
^ ' output sequence of LFSR-combinational generators has been developed. 

[~--. ' The computational method is based exclusively on the handhng of binary 

t~^ , strings by means of logic operations. The proposed model can serve as 

Cn ' a deterministic alternative to existing probabilistic methods for checking 

Cn I balancedness in binary sequence generators. The procedure here described 

(/-\ . can be devised as a first selective criterium for acceptance/rejection of this 

C^ ' type of generators. 

f^ , Keywords: Balancedness, Bit-string model, Combinational generator, 

Design rules 

^ ■ 1 Introduction 



Pseudorandom binary sequences are simple tools with application in fields so 
different as spread-spectrum communications, circuit testing, error-correcting 
codes, numerical simulations or cryptography. Most generators producing these 
sequences are based on combinational Boolean functions [5] and Linear Feedback 
Shift Registers (LFSRs) [3]. These combinational generators (in the sequel 
LFSR-combinational generators) can include an unique LFSR (nonlinear filters) 
or more than one LFSR (nonlinear combination generators) . In both cases, the 
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output sequence is a periodic sequence generated as the image of a nonlinear 
Boolean function F in the LFSR cells (see [7], [8]). 

Balancedness in the generated sequence is one necessary condition that ev- 
ery LFSR-combinational generator must satisfy. Roughly speaking, a binary 
sequence is balanced whether it has approximately the same number of I's as 
O's. Due to the long period of the sequences produced by LFSR-combinational 
generators (for instance, T ~ 10"^* bits in current cryptographic applications), 
it is unfeasible to generate an entire cycle and then count the number of I's 
and O's. Therefore, in practical design of binary generators, portions of the 
output sequence are chosen randomly and statistical tests (e.g. frequency test 
or monobit test [5]) are applied to all these subsequences. Nevertheless, pass- 
ing the previous tests merely provides probabilistic evidence that the generator 
produces a balanced sequence. 

In the present work, balancedness of LFSR-combinational generators has 
been treated in a deterministic way. In fact, a simple binary model allows one to 
compute the exact number of I's in the output sequence without producing the 
whole sequence. From such a model, the general expression of the number of I's 
is obtained as a function of the generator parameters. In this way, the degree of 
balancedness of such a sequence can be perfectly checked: the obtained number 
of I's is compared with the value required for this sequence to be balanced 
(half the period ± a tolerance interval). In case of non- accordance, the LFSR- 
combinational generator must be rejected. Thus, the procedure here developed 
can be considered as a first selective criterium for acceptance/rejection of this 
type of generators. 

The computational method is based exclusively on the handling of binary 
strings by means of logic operations (OR, AND). Indeed, the general expression 
of the number of I's is just an interpretation of such binary strings. As a straight 
consequence of this method, practical rules to design generators with balanced 
(quasi-balanced) output sequences are also derived. The procedure can be ap- 
plied to LFSR-combinational generators in a range of practical interest. Some 
illustrative examples including filters and combination generators complete the 
work. 



2 Fundamentals and Basic Concepts 

Several basic concepts and definitions to be used throughout the paper will be 
presented in the following subsections. First of all, the concept of minterm is 
introduced: 

Definition 2.1 A minterm of L binary variables (rriQ, mi, ..., jtil-i) is a mono- 
mial of the L variables, where each variable can be in its true or complementary 
form. For L variables, there exist 2^ minterms, each minterm being expressed 
as the logic product of the L (appropriately complemented) variables. 

A minterm of L variables is denoted by Ma where a is a binary configuration 
of L bits. The i-th bit (numbered from right to left) is 1 if the variable m^ is 



in true form and if the variable rrii is in complementary form. Since a binary 
sequence generator is characterized by a Boolean function, the representation 
of such functions is considered. 

2.1 Representation of Boolean Functions 

Two different representations of Boolean functions are introduced. 

1. Boolean functions in Algebraic Normal Form: Any L-variable Boolean 
function can be uniquely expressed in Algebraic Normal Form (ANF) or 
Miiller expansion ([S], [5]) by means of the exclusive-OR sum of logic 
products in the L variables. A simple example of Boolean function in 

ANF is: 

F(r7io, mi, ..., rriL-i) = tol-i m-i mo © mL-2 mi m^-i, 

where the concatenation of variables represents the logic product and the 
symbol © the exclusive-OR logic operation. 

2. Boolean Junctions in terms of their minterms: Any L-variable Boolean 
function can be canonically expressed as a linear combination of its minterms 
([5], [9]). A simple example of Boolean function in terms of its minterms 
is: 

F'(mo, mi, ..., niL^i) = Afio...oi ® M01...10 • 

In the term Afio...oi = m-^-i mi_2 • • • mi tuq only the variables tuq and 
m,i_i are in true form while in the term A/01...10 = t^l~i fnL-2 ■ ■ ■ m-i mo 
only the variables m,o and m^-i are in complementary form. 

In this work, both representations of Boolean functions will be systematically 
addressed. 

2.2 LFSRs and Minterm Functions 

A binary LFSR is an electronic device with L memory cells (stages), numbered 
0, 1, ..., L — 1, each of one capable of storing one bit. The binary content of the L 
stages at each unit of time is the state of the LFSR at that instant. In addition, 
a clock controls the shift of data. At each unit of time the following operations 
[3] are performed: (i) The content of stage is output ; (ii) the content of stage 
i is moved to stage i — 1 for each i,l<J<i — 1; (iii) The new content 
of stage L — 1 is the exclusive-OR of a subset of stages given by P{x), that is 
the LFSR connection polynomial. If P{x) is a primitive polynomial of degree 
L [4], then the LFSR is called a maximum-length LFSR. In the sequel, only 
maximum-length LFSRs will be considered. 

Definition 2.2 An LFSR-combinational generator is a nonlinear Boolean Junc- 
tion F dejined as F : GF{2)^ — {0} —5- GF{2), whose input variables rrii (z = 
0, ...,L — 1) are the binary contents oj the LFSR stages. 



At each new clock pulse, the new binary contents of the stages will be the 
new input variables of the function F. In this way, the generator produces the 
successive bits of the output sequence. An LFSR-combinational generator is a 
nonlinear Boolean function F given in its ANF. 

Definition 2.3 A minterm function is a minterm of L variables expressed in 
ANF. Every minterm function can be easily obtained by expanding out the cor- 
responding minterm. 

Let Ma be a minterm of L variables where a includes d V s in its binary 
representation with {1 < d < L). According to [S], its corresponding minterm 
function is perfectly characterized: 

• Such a minterm function has ( g ) terms of order d, ( ~ j terms of order 
d + 1, (^2 '*) terms of order d + 2, . . ., (^Ijj) terms of order L, so in total 
the number of terms is: 

No. of terms ^ 2^-"^. (1) 



• 



The particular form of the terms of each orden is perfectly determined 
too, see [S]. 



On the other hand, every minterm function considered as an combinational 
generator applied to the L stages of an LFSR generates a canonical sequence 
with a unique 1 and period T — 2^ ~ 1 (see [7]). The location of this 1 depends 
on the LFSR initial state. Let us see for a simple example the particular form 
of the minterm functions and their corresponding canonical sequences. 

Example 2.4 For a LFSR of L — 3 stages, connection polynomial P{x) = 
x^ + x"^ -\- 1 and initial state (1 1 0) we have: 

Mm == ma mi mo i — > {0,0,0,0,0,0,1} 

Miio = m2 mi mo = m2 mi mo ® m2 mi i — )■ {0,0,0,0,0,1,0} 

-^101 = ''T12 ^1 Wo = m.2 m-i m-o ® m,2 m-o < — > {0,0,0,0,1,0,0} 

Moio = ^2 Wi mo = m2mi mo ©m2mi © mi mo ® mi i — )■ {0,0,0,1,0,0,0} 

-^100 = "T-2 wi mo = m2 mi mo © m2 mi © m2 mo © m2 < — > {0,0,1,0,0,0,0} 

Mqoi —rn2mimo — m2mimo ®m2mo(Bmimo(Bmo < — > {0,1,0,0,0,0,0} 

Mqii ~ rn2 mi rriQ = m2 mi ruQ (B mi ruQ i — S- {1,0,0,0,0,0,0}. 

The left column represents the minterms and their corresponding minterm func- 
tions while the right column shows the generated sequences when the LFSR cycles 
through its 2^^ — 1 states 

(110), (100), (001), (010), (101), (Oil), (111). 

In this way, an arbitrary combinational generator e.g. F = Mooi © Afgio © 
Mioo applied to the 3 stages of the previous LFSR will produce the sequence 
{0,1,1,1,0,0,0}. That is to say, the bit-wise exclusive-OR of the canonical 



sequences associated to the corresponding minterms. Remark that the minterm 
with all the variables in complementary form is excluded from the succession of 
minterms as well as the state all zeros is excluded from the succession of LFSR 
states 0/. 

Let us now generalize the concept of minterm function when more than one 
LFSR are involved. 

2.3 Generalization of the Minterm Functions to more than 
one LFSR 

The generalization of the previous concepts to several LFSRs is quite imme- 
diate. In fact, let A, B,..., Z be maximum-length LFSRs whose lengths are 
respectively L^, Lb, ■■■, Lz (supposed {Li,Lj) = 1, i ^ j). We denote by 
Oi (i = Q,...,La ~ 1), hj {j = Q,...,Lb - 1), ... , Zk {k ^ 0,...,Lz - 1) their cor- 
responding stages. The minterms of a nonlinear combination generator, called 
global minterms, are of the form, e.g. 

that is the logic product of the individual minterms of each LFSR. Therefore, 
each global minterm depends on L variables, where L is given by: 

L^La+ Lb+ ■■■+ Lz- 

A global minterm function is a global minterm of L variables expressed in ANF 
As before every global minterm function considered as a combinational generator 
applied to the stages of the LFSRs [7] produces a canonical sequence with an 
unique 1 and period T = (2-^^ - l)(2-^« - 1) ... (2^^ - 1). The location of this 
1 depends on the initial states of the LFSRs. 

In brief, every LFSR-combinational generator can be expressed as a linear 
combination of its minterms as well as each minterm provides the output se- 
quence with a unique 1. Thus, the basic idea of this work can be summarized 
as follows: 

The number of minterms in the expression of F equals the number of I's in 
the output sequence. 

As every LFSR-combinational generator is designed in Algebraic Normal 
Form, the Boolean function F has first to be converted from its ANF into 
its minterm expansion. Then, the computation of minterms will give us the 
corresponding number of I's in the output sequence and consequently its exact 
degree of balancedness. 

2.4 Conversion Method from Algebraic Normal Form into 
Minterm Expansion 

In order to carry out this conversion, the following function that maps Boolean 
functions to their dual functions is defined: 



Definition 2.5 Let F be a Boolean function given in ANF. The function ^p 
is defined as a Boolean function that substitutes each term mi mj ... mk of F for 
its corresponding minterm M^ where a includes I's at the i-th, j-th, . . ., k-th 
positions. 

Keeping in mind that $f o $f = F (that is ^p is an involution [2]), the 
general conversion method can be described in the following steps: 
Input: A nonlinear Boolean function in ANF, e.g. 

F{mo, mi, m2) = m2 mo © TO2 mi © mi. 

• Step 1: Define ^p 

$F(mo, mi, ms) = ^fioi © Mno © Mqio ■ 

• Step 2: Substitute every minterm by its corresponding minterm function 
and cancel common terms 

<i>i?(mo, mi, m2) — (m2 mi mo © m2 mo) © 
(?7i2 m-i m-o © m,2 m-i) © 
(m2 mi mo © m2 mi © mi mo © mi) 
= m2 mi mo © m2 mo © mi mo © mi . 

• Step 3: Apply the function ^p again 

$FO$F(mo, mi, m2) = F(mo,mi,m2) = Mm © Mioi © Mon © Moio • 

Output: F expressed in terms of its minterms. 

The number of minterms in step 3 gives the number of I's in the generated 
sequence. Notice that such a number equals the number of non-cancelled terms 
in step 2. This will be the criterium followed in the next section. 

3 A Binary Model to Calculate the Degree of 
Balancedness in LFSR-Combinational Gener- 
ators 

A computational procedure that automates the comparison among different 
minterm functions in $f, checks the cancelled terms and computes the num- 
ber of final terms is presented. Such a procedure is based on an L-bit string 
representation. 

3.1 Additional Definitions for the Computation 

For the sake of simplicity, the functions F and $f will be written as _F = ttIq . 

i 

and ^F — ® A/fii, respectively, where represents the exclusive-OR sum on 

i i 

the index i. 



The own definition of minterm offers us a natural representation regarding 
the computational procedure. In fact, every minterm Ma is represented by an 
L-bit string numbered 0,1,..., L — 1 from right to left. As before, if the i-th 
variable rui is in its true form, then the i-th bit of such a string takes the value 
1; otherwise, the value will be 0. According to equation (P), the number of 
terms in the minterm function of Ma is 2-^~''(") terms, d {a) being the number 
of I's in a. 

Definition 3.1 We call maximum common development (mcd) oj two minterms 
Ma and Mp, notated AID {Ma, Mp), to the minterm M^ such that % = a U /3. 

Under this L-bit string representation, the mcd can be realized by means of a 
bit-wise OR operation between the binary strings of both minterms. The mcd 
represents all the terms that the minterm functions of Ma and Mp have in 
common. For instance, for an LFSR oi L — 4 stages and given two minterm 
functions: 

-M^ooii = fTT-s TO2 mi Too © m^ mi toq © m2 mi toq © toi toq 
-Miooi = fTT-s TO2 TOi Too © TOs m2 mo © m^ toi too © TO3 toq 

the mcd is: 

MD (A/ooii, ^^looi) = Miou = ms TO2 toi toq © ma mi mo , 

that is to say the common terms to both functions. 

If the two minterm functions of Ala and Mp are added. Ma © Mp, then the 
terms corresponding to their mcd are cancelled. Thus, the total number of terms 
in Ma(BMp is the number of terms in Ala plus the number of terms in Mp minus 
twice the number of terms in the mcd, that is 2^-''(") + 2^-'^^l'^'> - 2 ■ 2^-'^("U/J)_ 

Then, we introduce a new kind of auxiliary function notated H. 

Definition 3.2 The auxiliary function H is defined as H = ® s^A/q,;, s^ being 

i 

an integer with sign that specifies how many times A'la^ is contained in H . 

In a symbolic way, H indicates whether the minterm functions A/q. are added 
(sign +) or cancelled (sign -) as well as how many times such functions have been 
added or cancelled. A function H is a special way of recording what happens 
when different minterm functions are operated. 

Finally, the mcd can be applied to the functions H too. 

Definition 3.3 Given two auxiliary functions Hi ~ ^ SiMa^ and Hm = ® SjAIp. , 

i 3 

the maximum common development is defined as 

AID iHi,Hrn) =00 {s^s,) AID {AIa,,Mp^) =00 (s^s,) Af„,uft (2) 

i j i j 

where SiSj is the integer product between both factors. 

As before the mcd of functions H represents the common terms to both 
functions. Next, the computational method is described. 



3.2 Computation of the Number of I's in the Output Se- 
quence for Generators with one LFSR 

Let F ~ Qnia. {i = 1,...,A^) be a nonlinear Boolean function of N terms 

i 

applied to the L stages of an LFSR. The aim of this section is to compute the 
number of I's, notated Up, in the sequence generated by F. Throughout the 
computation, the most complicated feature is to know what mintcrms and how 
many times are repeated (or cancelled) without keeping an exhaustive record 
of them. For example, let Mq,j, Mq^ and Ma^ be minterms in ^p. Indeed, 
.^^qiUq2 ^^^ the common terms to Mq^ and Ma^ that have to be eliminated. 
In addition, MojUaa have the same meaning concerning Ma^ and Ma^- The 
question that arises in a natural way is: what happens with the terms of MQ,jUa2 
that are repeated in M^jUas but that have been previously cancelled? A similar 
situation occurs when Ma^uQa i^ compared with MQjUa2 and AfaiUaa- The 
situation becomes worse and worse when more minterm functions are involved. 
In fact, when Ma- an arbitrary minterm of ^p is considered, then the auxil- 
iary function Hi keeps count of the minterms involved so far as well as it keeps 
count of which of them are repeated or cancelled. At the end of the procedure, 
when the last minterm Ma,^ is introduced, then the auxiliary function H^ in- 
cludes all the final minterms with their corresponding signs. The last step of 
this computation is just to determine the number of I's in the output sequence 
by counting the number of terms included in each minterm Ma of H^ (see sub- 
section 2.4). According to equation ([T]), this number is given by 2^~'^("^). So 
keeping in mind all these considerations, the following computational procedure 
is introduced: 

Input: A nonlinear Boolean function in ANF, e.g. F — ^ niai [i — 1, ..., N). 

i 

• Step 1: Define the function $i? from the N terms ttIq. of F. Initialize the 
function Hq with a null value, 

Ho = Q). (3) 

• Step 2: ¥oT i = I, . . . , N 

H, = i/,_i + Ma, - 2 ■ MD {Ma,,H,^i) . (4) 

• Step 3: From the final form of H^ = X) ■* j ^'^P ' compute the number of 

j 
I's in the generated sequence by means of the expression 

Uf=Y.s,-2^-''^P^K (5) 

3 

Output: Up that is the number of I's in the output sequence. 

In this way, the number of I's is obtained as an exponential function in the 
length of the LFSR. Comparing Up with the expected value {Up « T/2), the 
acceptance/rejection criterium can be applied. 



3.3 Computation of the Number of I's in the Output Se- 
quence for Generators with more than one LFSR 

For several LFSRs A, B, ..., Z of lengths La, Lb, ■■■ , Lz respectively with L = 
La + Lb + ... + Lz, the procedure is analogous to the previous one except for: 

1. The bits of the i-bit strings are assigned to the different LFSRs such 
as follows: the first La bits (from right to left) correspond to the repre- 
sentation of the individual minternis of the LFSR A. The next Lb bits 
correspond to the representation of the individual minterms of the LFSR 
B ... the last Lz bits correspond to the representation of the individual 
minterms of the LFSR Z 

2. Now each d{fij), the number of I's in the j-th L-bit string of Up can be 
expressed as: 

d{p,)^dA{Pj) + dB{Pj)+ ■■■+ dziPj) (6) 

where di{(3j) is the number of I's in the bits assigned to the I-th LFSR. 
Thus, the number of I's in the output sequence Up can be trivially rewrit- 
ten as: 



Remark that if a minterm of ^p does not contain any individual minterm, then 
the corresponding bits in the L-bit string are filled with zeros and the string 
includes the 2^^ — 1 individual minterms of the corresponding LFSR. 

3.4 An Example 

Let A,B,C be three LFSRs of lengths La,Lb,Lc respectively. The LFSR- 
combinational generator is chosen: 

3 

F{ao, bo, Co) = ^ rria^ = oo^o © boCo © cq , 

which corresponds to the Geffe's generator [5]. In order to fix the L-bit strings, 
very low values are assigned to the lengths of the LFSRs: La = 2, Lb = 3, Lq = 
5, with {{Li, Lj) = 1, i ^ j), thus L = 10. According to the previous subsection, 
we proceed: 

3 

Step 1.- ^p{aQ,bo,co) = Ma, = Aq Bq (S BqCq © Co and the 
minterms of $f in 10-bit string format are: 

M„, = AaBo = 00000 001 01 
M„, = Bo Co = 00001 001 00 
M„3 = Co = 00001 000 00 . 



H is initialized Hq ^ . 
Step 2.- For i = 1, . . . , 3. 

i — I.- The mcd of Ma^ and Hq is 

MD (M„, , iJo) = MD (00000 001 01, 0) = 

and the updated H is 

Hi= Ho + M„, - 2 • MD (M„, , i^o) == 00000 001 01. 

i = 2. -The mcd of M^j and Hi is 

MD{Ma^,Hi) = 00001 001 01. 

and the updated H is 

H2 = Hi+ M„, -2-MD (M„,, Hi) = 

00000 001 01 + 00001 001 00 - [2] 00001 001 01. 
i = 3.- The mod of M^g and H2 is 

MD{M^,,H2) = 
00001 001 01 + 00001 001 00 - [2] 00001 001 01 = 
00001 001 00 - [1] 00001 001 01. 
and the updated ^3 is 

H3 = H2 + M„3 -2-MD (M,3 , ifa) = 

00000 001 01 + 00001 000 00 - [1] 00001 001 00. 
Step 3.- Calculation of the number of I's from H3 



00000 001 01 implies 2^-*-! 2^^-^ (2^^ - 1) ones 

00001 000 00 implies (2^^ - 1) (2^« - 1) 2^c~i ones 
- [1] 00001 001 00 implies - (2^-* - 1) 2^«-i 2^c-i o^es. 

Thus, 

Uf = 2^-*-i2^«-i(2^^ - l) + (2^^ -1)(2^« -1)2^^-1 
-(2^-* - l)2^^"i2^^"i 
= 2^-*"i 2^^"i (2^<^ - 1) + (2^^ - 1) (2^^"i - 1) 2^c-i^ 



10 



For lengths of the LFSRs in, for instance, a cryptographic range L,; « 64 the 
number of I's in the output sequence is ~ T/2. Consequently, the generated 
sequence is balanced. 

The application of this procedure gives us a general expression for the num- 
ber of I's in the sequence produced by a Geffe's generator. From very low values 
oi Li, a general expression is achieved that can be applied to LFSR lengths in 
a range of practical interest. Similar results can be obtained by applying the 
previous procedure to other standard LFSR-combinational generators [5]. 

It must be noticed that Up depends exclusively on the LFSR lengths but 
not on the connection polynomials. Thus, the same combinational generator 
applied to different LFSRs of the same lengths will give sequences with the same 
number of binary digits. Remark that the particular form of these generators. 
Boolean functions with a few terms of low orders, allows one the application of 
the computational procedure with negligible time and memory complexity. 

4 Practical Design of Balanced Sequence Gen- 
erators 

From the previous section, practical rules to design balanced LFSR-combinational 
generators can be deduced. The application to nonlinear filters or nonlinear 
combination generators is considered separately. 

4.1 Application of the Computational Model to Nonlinear 
Filters 

A simple rule to guarantee balancedness in the output sequence of nonlinear 
filters is introduced. 

Proposition 4.1 Let F be a Boolean function of the form 

F{mo, mi, ..., rriL-i) = F'{mQ, mi, ..., rrij^i, nij+i, ..., niL-i) ® rrij, 

where F' is an arbitrary Boolean function in L^l variables given in ANF Then, 
the output sequence generated by the nonlinear filter F is balanced. 

Proof: According to the previous notation mj — maj^, then the last term 
of ^F will be Maj^ = Mj. Therefore, at the iV-th loop, the final updating of H 
is: 

Hn = Hn-i+ M^^ -2-MD (Af„„ ,Hn^i) 

Nevertheless, the terms -ffjv-i and 2 • MD {M^^ , -ffjv-i) in the second member 
contains exactly the same binary strings except for the j-th index. Thus, from 
the point of view of the number of I's and for every pair of quasi-equal strings, 
we have: 

2^-'-' - 2 • 2^-('''+i) = 2^-^ - 2^-'' = Vfc. 



11 



Therefore, the final number of I's in the sequence generated is due exclusively to 
the contribution of the term Maj^ and such a contribution is 2^~^ ones. Thus, 



Up 



iL-l 



Consequently, the output sequence of such generators will always be balanced. 

D 
This result can be directly applied to TOYOCRYPT-HRl keystream gener- 
ator for the stream cipher TOYOCRYPT-HSl [1]. In fact, this pseudorandom 
binary generator includes an LFSR of length L = 128 where the last stage, no- 
tated TO127, appears as a unique term with non-repeated index in the Boolean 
function F. In this practical example and according to the previous algorithm 
the balancedness of the output sequence is guaranteed. 

4.2 Application of the Computational Model to Nonlinear 
Combination Generators 

The procedure explained in subsection 3.3 lets us determine the number of I's 
in the sequence obtained from any nonlinear combination generator. Let us see 
its application to the following examples made up of three LFSRs. 

Fo = aobo © boco ® aoco ® ao © &o © co 
Fi = agbo © boCo © oq © 60 ffi cq 
F2 = ao6o ffl 5oCo © 60 
F3 = aobo ffi boCo © aq 
F4 = aobo ffi Co 

In all cases the period of the generated sequence is T = (2^^ — 1)(2^^ — 
1)(2^<^ — 1) (supposed {Li, Lj) — 1, i j^ j).The general expressions that quantify 
the number of I's for the above generators are obtained such as follows: 

Function Fq: the corresponding _ffg is: 

He = + [I] 00000 000 01 + [1] 00000 001 00 + [1] 00001 000 00 

- [1] 00000 001 01 - [1] 00001 001 00 - [1] 00001 000 01. 

Thus, 

Up = 2^-^-1 (2^« -1)(2^^ - 1)+ (2^-* - l)2^«-i(2^c _ 1) 
+ (2^-* - 1) (2^« - 1) 2^^"i - 2^-1^1 2^«"i (2^c _ 1) 
- (2^-^ - 1) 2^«"i 2^^"i - 2^-*"! (2^« - 1) 2^c-^ 

Up ^ T/2 + r/4. 
Function Fi: the corresponding i/s is: 

H5 = + [1] 00000 000 01 + [1] 00000 001 00 + [1] 00001 000 00 

- [1] 00000 001 01 - [1] 00001 001 00 - [2] 00001 000 01 
+ [2] 00001 001 01. 
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Thus, 

Up = 2^-*-i(2^« - 1)(2^^ -1)+ (2^-* - l)2^«-i(2^c - 1) 
+ {2^^ - 1) (2^« - 1) 2^^'"i - 2^-*"^ 2^«"i (2^^ - 1) 
_ (2i>i - 1) 2^B-i 2^^"i - 2 • 2^-*"i (2^s - 1) 2^c-i 
I 2 . 2"^^^! 2"^-^^^ 2"^'^^"'" 

Wf :^ T/2 + r/4. 
Function F2: the corresponding i/s is: 

H3 = - [1] 00000 GDI 01 - [1] 00001 001 00 + [2] 00001 001 01 
+ [1] 00000 001 00. 

Thus, 

Up = -2^-*"i2^«"i (2^c - 1) - (2^-* - l)2^s"i2^^"i 

+ 2 ■ 2^-*"i 2^«"i 2^^"i + (2^-* - 1) 2^«"i (2^c' _ 1)^ 

Wf =i T/4. 
Function F3: the corresponding i/a is: 

H3 ^ - [1] 00000 001 01 + [1] 00001 001 00 + [1] 00000 000 01. 

Thus, 

Up = -2^-*-^2^«-i (2^c _ 1) ^ (2^-* - l)2^«-i2^<^-i 
+ 2^-^-1 (2^« - l)(2^c _ ly 

Up ^ T/2. 
Function F4: the corresponding H2 is: 

H2 = + [1] 00000 001 01 + [1] 00001 000 00 - [2] 00001 001 01. 

Thus, 

Up = 2^^-i2^«-i(2^c -1)+ (2^-* - 1)(2^« - l)2^c-i 
_ 2 . 2^^^^ 2^^^^ 2^'^^^ 

Up ~ T/2. 

Table 1. shows the number of V s for a particular choice of La, Lb, Lc- In 
the rightmost column there appears the order of magnitude of the number of 
I's when La, Lb, Lc take values in a cryptographic range. In fact, some kinds 
of Boolean functions must be avoided: 

• The generators Fq , Fi include all the first order terms ao,bo, cq what means 
a great number of non-cancelled terms in ^p, consequently their corre- 
sponding number of I's will be greater than T/2. 
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• The generator F2 includes &o in all the terms what means a great number 
of cancelled terms in $i?, consequently its corresponding number of I's 
will be less than T/2. 

These forms of Boolean functions will never be balanced and consequently 
must be rejected. Fj, is similar to F2 except for fact that the linear term 60 does 
not appear in all the terms. In this way, i^s as well as Fi, with non- repeated 
terms, produce sequences with a balanced number of non-cancelled terms in 
$F what means a number of I's in the range of ~ T/2. Thus, the appearance 
and/or repetition of the different variables determine the degree of balancedness 
in the output sequence. 

In brief, a simple study of any particular Boolean function allows the de- 
signer to know whether the considered sequence has a number of I's in the 
desired range of magnitude. Small variations in the form F improve signifi- 
cantly balancedness in the generated sequence. 

5 Conclusions 

In the present work, a binary model to compute the number of I's in the se- 
quence obtained from LFSR-combinational generators has been developed. The 
computational procedure enables one to determine the actual degree of bal- 
ancedness in the output sequence without generating the whole sequence. The 
procedure is based on the comparison and cancellation of the common terms 
in the function $p of the generator. According to an adequate binary repre- 
sentation of mintcrm functions, the procedure can be carried out by realizing 
elementary logic operations on binary strings. The application of the method to 
examples with LFSRs of reduced length gives general expressions for the num- 
ber of I's in the sequences obtained by standard generators published in the 
open literature. Some simple rules for the design of balanced generators (cither 
nonlinear filters or combination generators) are also derived. 
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Table 1: Numerical results for different combination generators 





La 


Lb 


Lc 


Expected No.l's 


Actual No.l's 


Order of magnitude 


Fo 


7 


8 


9 


8274368 


12411328 


~ T/2 + T/4 


Fi 


7 


8 


9 


8274368 


12427712 


~ T/2 + T/4 


F2 


7 


8 


9 


8274368 


4153472 


~T/4 


F3 


7 


8 


9 


8274368 


8314944 


~T/2 


Fi 


7 


8 


9 


8274368 


8282368 


~T/2 
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